fad73cf4cfbfebce73f89d548ed5fb5fbac92515be6d117273a9620572efc6b7

Analysis

max time kernel
113s
max time network
116s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
18-09-2023 08:21

Target

fad73cf4cfbfebce73f89d548ed5fb5fbac92515be6d117273a9620572efc6b7.exe
Size

371KB
MD5

697ef25bb70915e7ab484948f51d120d
SHA1

83a7b19cb2c27fc59873d8312d682e9914e473eb
SHA256

fad73cf4cfbfebce73f89d548ed5fb5fbac92515be6d117273a9620572efc6b7
SHA512

91f5653c6493b2657620bc3119488637350d69113022b253d636d27de63865e3c2c2ed8562f28c63a85a4846a230545d8dd6ff5f4c602b993035fd6cc2ba6358
SSDEEP

6144:T5vJm09zORs+z/TMify9DAORgQz+0yrstnBwVf++8CFZLLKjl4Vsw1y8bNe6jkf4:T5w09CK5NgDRLx/8QJs4rgn8/

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 564 set thread context of 4212	564	fad73cf4cfbfebce73f89d548ed5fb5fbac92515be6d117273a9620572efc6b7.exe	70

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 4212	564	fad73cf4cfbfebce73f89d548ed5fb5fbac92515be6d117273a9620572efc6b7.exe	70
PID 564 wrote to memory of 4212	564	fad73cf4cfbfebce73f89d548ed5fb5fbac92515be6d117273a9620572efc6b7.exe	70
PID 564 wrote to memory of 4212	564	fad73cf4cfbfebce73f89d548ed5fb5fbac92515be6d117273a9620572efc6b7.exe	70
PID 564 wrote to memory of 4212	564	fad73cf4cfbfebce73f89d548ed5fb5fbac92515be6d117273a9620572efc6b7.exe	70
PID 564 wrote to memory of 4212	564	fad73cf4cfbfebce73f89d548ed5fb5fbac92515be6d117273a9620572efc6b7.exe	70
PID 564 wrote to memory of 4212	564	fad73cf4cfbfebce73f89d548ed5fb5fbac92515be6d117273a9620572efc6b7.exe	70
PID 564 wrote to memory of 4212	564	fad73cf4cfbfebce73f89d548ed5fb5fbac92515be6d117273a9620572efc6b7.exe	70
PID 564 wrote to memory of 4212	564	fad73cf4cfbfebce73f89d548ed5fb5fbac92515be6d117273a9620572efc6b7.exe	70
PID 564 wrote to memory of 4212	564	fad73cf4cfbfebce73f89d548ed5fb5fbac92515be6d117273a9620572efc6b7.exe	70
PID 564 wrote to memory of 4212	564	fad73cf4cfbfebce73f89d548ed5fb5fbac92515be6d117273a9620572efc6b7.exe	70

C:\Users\Admin\AppData\Local\Temp\fad73cf4cfbfebce73f89d548ed5fb5fbac92515be6d117273a9620572efc6b7.exe
"C:\Users\Admin\AppData\Local\Temp\fad73cf4cfbfebce73f89d548ed5fb5fbac92515be6d117273a9620572efc6b7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4212

memory/4212-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4212-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4212-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4212-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4212-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download